Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof WhatsApp to trick targets into linking their account to an attacker-controlled device. The activity targets researchers, diplomats, and defense-related staff in Europe and the U.S., often through personal accounts that are harder for organizations to monitor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a ‘U.S. State Department’ contact inviting you to an exclusive security conference. The catch? It tells you to create a specific app password so they can ‘pre‑register’ you. That’s an app password the attacker already knows, letting them log in without triggering your MFA. Same play with fake GLOBSEC invites and WhatsApp pages: they look legit, but the page itself is asking for a Microsoft device code or to link your WhatsApp to a new device. Real services don’t need you to send them codes from some random site. If any invite or message tells you to create an app password or enter a code from their page, stop. Close it and contact our security team before you touch your account settings.
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
